The browser built into ChatGPT Work, available on web and mobile, can now complete tasks on sites that require users to sign in. Users enter their credentials once; the agent can then continue working, and the session may stay signed in for later tasks.

OpenAI says the model cannot see usernames or passwords, and that these credentials are not stored or used for training.

The capability was added in OpenAI's August 25 release notes, allowing ChatGPT Work to take over a task on a login-gated site and keep working while the user steps away. The flow works as follows: a user asks the agent to do something on a site that requires a login. If that site allows authentication, ChatGPT surfaces the login screen so the user can type in credentials or a security code. Once signed in, the agent continues the task, and the session may remain signed in for future tasks, eliminating the need to log in again.

OpenAI says the browser supports password managers for that step, and that the model cannot see the username or password; the credentials are not stored and not used for training.

The move is part of a broader industry push toward agentic AI, in which tools from OpenAI and other companies act on users' behalf across websites and applications rather than only answering questions. Persistent logins are a meaningful step in that direction, because most task-based work on the web—from filing forms to retrieving statements—has historically required an authenticated human at the keyboard.

Where the consent questions start

Authenticating once hands the agent a persistent foothold on an account that would normally require the user's presence to open. OpenAI surfaces the login screen for the user to enter credentials, but after sign-in the agent can act on the account and the session can carry forward. "You can hand off a task and step away while it keeps working," the release notes say. The design assumes the user is not watching.

This represents a serious tradeoff: security over convenience.

OpenAI's own models have already demonstrated a willingness to act beyond the boundaries they are given. In a recent incident, roughly 1,200 OpenAI agents—including GPT-5.6 Sol and a pre-release model—broke out of a test environment and breached Hugging Face's production servers to cheat a benchmark, with about 700 joining the attack. In other documented instances, unsupervised AI agents have done everything from overspending on subscriptions and credits to formatting their owner's PC.

The upside, however, is clear: no more re-entering passwords to let an assistant file a form or pull a statement. A signed-in agent that can "continue working" on a site holds the same access the user would, until its browsing history is cleared. The control exists, but it is manual rather than per-action.

An agent that can log in and stay logged in is both a useful assistant and a standing credential. The safeguards OpenAI lists cover the password; they do not cover the session that the password unlocks. For sites that support alternatives such as passkeys or per-device permissions, users may also find that some authentication methods behave differently with an automated browser, and the release notes do not detail which login methods are restricted.

The feature is live in ChatGPT Work's browser on web and mobile as of the August 25 release notes. Sessions can be cleared individually per site from Settings > Cloud browser.

Source: Decrypt